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Abstract 

This research work presents a new class of non-bhnd information hid- 
ing algorithms that are stego-secure and robust. They are based on some 
finite domains iterations having the Devaney's topological chaos prop- 
erty. Thanks to a complete formalization of the approach we prove se- 
curity against watermark-only attacks of a large class of steganographic 
algorithms. Finally a complete study of robustness is given in frequency 
DWT and DCT domains. 

1 Introduction 

This work focus on non- blind binary information hiding chaotic schemes: the 
original host is required to extract the binary hidden information. This context 
is indeed not as restrictive as it could primarily appear. Firstly, it allows to 
prove the authenticity of a document sent through the Internet (the original 
document is stored whereas the stego content is sent). Secondly, Alice and 
Bob can establish an hidden channel into a streaming video (Alice and Bob 
both have the same movie, and Alice hide information into the frame number 
k iff the binary digit number k of its hidden message is 1). Thirdly, based 
on a similar idea, a same given image can be marked several times by using 
various secret parameters owned both by Alice and Bob. Thus more than one 
bit can be embedded into a given image by using this work. Lastly, non-blind 
watermarking is useful in network's anonymity and intrusion detection [T] , and 
to protect digital data sending through the Internet [5] . Furthermore, enlarging 
the given payload of a data hiding scheme leads clearly to a degradation of its 
security: the smallest the number of embedded bits is, the better the security 
is. 

Chaos-based approaches are frequently proposed to improve the quality of 
schemes in information hiding [U |4j [5l [6] . In these works, the understanding 
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of chaotic systems is almost intuitive: a kind of noise-like spread system with 
sensitive dependence on initial condition. Practically, some well-known chaotic 
maps are used either in the data encryption stage [H [5] , in the embedding into 
the carrier medium, or in both [31 [?]• Methods referenced above are almost 
based on two fundamental chaotic maps, namely the Chebychev and logistic 
maps, which range in R. To avoid justifying that functions which are chaotic in 
R still remain chaotic in the computing representation (i.e., floating numbers) 
we argue that functions should be iterated on finite domains. Boolean discrete- 
time dynamical systems (BS) are thus iterated. 

Furthermore, previously referenced works often focus on discretion and/or 
robustness properties, but they do not consider security. As far as we know, 
stego-security [8] and chaos-security have only been proven on the spread spec- 
trum watermarking [9] , and on the dhCI algorithm [T0| , which is notably based 
on iterating the negation function. We argue that other functions can provide 
algorithms as secure as the dhCI one. This work generalizes thus this latter 
algorithm and formalizes all its stages. Due to this formalization, we address 
the proofs of the two security properties for a large class of steganography ap- 
proaches. 

This research work is organized as follows. It firstly introduces the new 
class of algorithms (Sec. [5]), which is the first contribution. Next, the Section[3] 
presents a State-of-the-art in information hiding security and shows how secure 
is our approach. The proof is the second contribution. The chaos-security 
property is studied in Sec. |4] and instances of algorithms guaranteeing that 
desired property are presented. This is the fourth contribution. Applications 
in frequency domains (namely DWT and DCT embedding) are formalized and 
corresponding experiments are given in Sec. [5l This shows the applicability of 
the whole approach. Finally, conclusive remarks and perspectives are given in 
Sec.El 

2 Information hiding algorithm: formaUzation 

As far as we know, no result rules that the chaotic behavior of a function that 
has been established on R remains on the floating numbers. As stated before, 
this work presents the alternative to iterate a Boolean map: results that are 
theoretically obtained in that domain are preserved during implementations. 
In this section, we first give some recalls on Boolean discrete dynamical Sys- 
tems (BS). With this material, next sections formalize the information hiding 
algorithms based on these Boolean iterations. 

2.1 Boolean discrete dynamical systems 

Let us denote by |a; 6| the interval of integers: {a, a -|- 1, . . . , 6}, where a ^ b. 

Let n be a positive integer. A Boolean discrete-time network is a discrete 
dynamical system defined from a Boolean map f : B" — ^ B" s.t. 

X= {xi,.. .,Xn) ^-> f{x) = {fl{x), . . . , f„{x)), 



2 



and an iteration scheme: parallel, serial, asynchronous. . . With the parallel iter- 
ation scheme, the dynamics of the system are described by x*"'"^ = /(x*) where 
a;° G B". Let thus F/ : p;nl x B" to B" be defined by 

with the asynchronous scheme, the dynamics of the system are described by 
x*+i _ Ff{s*^,x*) where S B" and s is a strategy, i.e., a sequence in 
Notice that this scheme only modifies one element at each iteration. 
Let Gf be the map from X = |f ; nf x B" to itself s.t. 

Gf{s,x)^{a{s),Ff{s°,x)), 

where cr(s)* = s*+^ for all t in N. Notice that parallel iteration of G/ from an 
initial point = (s,a;°) describes the "same dynamics" as the asynchronous 
iteration of / induced by the initial point a;*' and the strategy s. 

Finally, let / be a map from B" to itself. The asynchronous iteration graph 
associated with / is the directed graph r(/) defined by: the set of vertices is 
B"; for all x G B" and i G |1; n|, r(/) contains an arc from x to Ff{i, x). 

We have already established [11] that we can define a distance d on X such 
that G/ is a continuous and chaotic function according to Dcvaney [12]. The 
next section focus on the coding step of the stcganographic algorithm based on 
Gf iterations. 

2.2 Coding 

In what follows, y always stands for a digital content we wish to hide into a 
digital host x. 

The data hiding scheme presented here does not constrain media to have a 
constant size. It is indeed sufficient to provide a function and a strategy that 
may be parametrized with the size of the elements to modify. The mode and 
the strategy- adapter defined below achieve this goal. 

Definition 1 (Mode) A map /, which associates to any ?i G W an application 
/„ : B" — > B", is called a mode. 

For instance, the negation mode is defined by the map that assigns to every 
integer n G IN* the function 

^„ : B" ^ B'',{xi,...,Xn) ^ (xT,...,x:;^). 

Definition 2 (Strategy- Adapter) A strategy- adapter is a function S from N 
to the set of integer sequences, which associates to n a sequence S G |1, nj^ . 

Intuitively, a strategy-adapter aims at generating a strategy (S**)*^^ where 
each term S** belongs to |l,n]. Moreover it may be parametrized in order to 
depend on digital media to embed. 
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For instance, let us define the Chaotic Iterations with Independent Strategy 
{CIIS) strategy-adapter. The CIIS strategy-adapter with parameters {K, y, a, I) G 
[0, 1] X [0, 1] x]0, 0.5[xIN is the function that associates to any n G N the sequence 
(5*)*^" dcfinGd by: 

• /■sT" — hin{y) © bin{K) : is the real number whose binary decomposition 
is equal to the bitwise exclusive or (xor) between the binary decomposi- 
tions of y and of K\ 

• yts^ l,K*+^ = F{K\a)\ 

• yts^l.S* =lnx A'*J + 1; 

• yt>i,s' = 0. 

where F is the piecewise linear chaotic map |13| . recalled in what follows: 

Definition 3 (Piecewise linear chaotic map) Let a g]0;0.5[ be a control 
parameter. The piecewise linear chaotic map is the map F defined by: 

te [0;a], 
t G [a; i], 
t G 

Contrary to the logistic map, the use of this piecewise linear chaotic map is 
relevant in cryptographic usages [T3]. 

Parameters of CIIS strategy-adapter will be instantiate as follows: K is the 
secret embedding key, y is the secret message, a is the threshold of the piecewise 
linear chaotic map, which can be set as K or can act as a second secret key. 
Lastly, I is for the iteration number bound: enlarging its value improve the 
chaotic behavior of the scheme, but the time required to achieve the embedding 
grows too. 

Another strategy- adapter is the Chaotic Iterations with Dependent Strategy 
(CIDS) with parameters {l,X) G W x B'^, which is the function that maps any 
n G IN to the sequence iS'r'' defined by: 

• Vt L if t s$ ; and X* = 1, then 5* = t, else 5* = 1; 

• yt>i,s'^ 0. 

Let us notice that the terms of x that may be replaced by terms taken from 
y are less important than other: they could be changed without be perceived 
as such. More generally, a signification function attaches a weight to each term 
defining a digital media, w.r.t. its position t: 

Definition 4 (Signification function) A signification function is a real se- 
quence (u'"')'^^'*'. 



F(t,a) 
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For instance, let us consider a set of grayscale images stored into portable 
graymap format (P3-PGM): each pixel ranges between 256 gray levels, i.e., is 
memorized with eight bits. In that context, we consider u'^ — 8— {k mod 8) to 
be the fc-th term of a signification function (u*^)''^^. Intuitively, in each group 
of eight bits (i.e., for each pixel) the first bit has an importance equal to 8, 
whereas the last bit has an importance equal to 1. This is compliant with the 
idea that changing the first bit affects more the image than changing the last 
one. 

Definition 5 (Significance of coeflficients) Let (u'')'^'^^ be a signification 
function, m and AI be two reals s.t. m < M. Then the most significant 
coefficients (MSCs) of x is the finite vector the least significant coefficients 
(LSCs) of X is the finite vector Um, and the passive coefficients of x is the finite 
vector Uj, such that: 

(A: I fc e IN and v}' ^ M and k < \ x \) 
(/c I fc e M and v!' <m and k < \ x \) 
(A: I fc G IN and u'' g]to; M[ and k < \ x \) 

For a given host content x, MSCs are then ranks of x that describe the 
relevant part of the image, whereas LSCs translate its less significant parts. 
We are then ready to decompose an host x into its coefficients and then to 
recompose it. Next definitions formalize these two steps. 

Definition 6 (Decomposition function) Let (m'^)''"^^ be a signification func- 
tion, *B the set of finite binary sequences, VI the set of finite integer sequences, 
m and M be two reals s.t. m < M. Any host x can be decomposed into 

iuM,Um,Up,(j)M,4'm,4'p) e^x9Tx9Tx*BxQ3x*B 

where 

• UM-, Um, and Up are coefficients defined in Definition (Sj 




The function that associates the decomposed host to any digital host is the de- 
composition function. It is further referred as dec{u, m, M) since it is parametrized 
by u, m, and M . Notice that li is a shortcut for (u^)^^^ . 

Definition 7 (Recomposition) Let (um, Wm, Up, (pM, 4'mi (f'p) £ ^ x x x 
«B X 03 X S s.t. 



UM = 
Um 

Ur, = 
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• the sets of elements in um, elements in Um, and elements in Up are a 
partition of |1, tt.]; 

• |uA/| = \vm\, \u„i\ = \(pm\; and \up\ = \(pp\. 
One can associate the vector 

\um\ 1"™! I«pl 

i—l i—1 i—1 

where (ei)ig]N is the usual basis of the R— vectorial space (R'^, +, .) (that is to 
say, e{ = 5ij^ where 5ij is the Kronecker symbol). The function that associates 
X to any {ui\i , UrmUp, (j)M i 4>m, (f'p) following the above constraints is called the 
recomposition function. 

The embedding consists in the replacement of the values of of x's LSCs 
by y. It then composes the two decomposition and recomposition functions seen 
previously. More formally: 

Definition 8 (Embedding media) Let dec(M, m, M) be a decomposition func- 
tion, a; be a host content, {um, Um, Up, (I'm, (I'rm <t>p) be its image by deciu, m, M), 
and y be a digital media of size \um\- The digital media z resulting on the em- 
bedding of y into x is the image of {um, Um, Up, (f)]\j, y, (/)p) by the recomposition 
function rec. 

Let us then define the dhCI information hiding scheme presented in |10| : 

Definition 9 (Data hiding dhCI) Let c!ec(u, m, M) be a decomposition func- 
tion, / be a mode, 5 be a strategy adapter, x be an host content, 
{uM,Um,Up,(j)M,4>m,4>p) be its image by dec{u,m,M), g be a positive natu- 
ral number, and y be a digital media of size I = \um\- 

The dhCI dissimulation maps any {x, y) to the digital media z resulting on 
the embedding of y into .t, s.t. 

• we instantiate the mode / with parameter I = |um|, leading to the function 

• we instantiate the strategy adapter S with parameter y (and possibly some 
other ones); this instantiation leads to the strategy Sy G 

• we iterate G/, with initial configuration {Sy,(j)m)] 

• y is finally the g-tli term of these iterations. 

To summarize, iterations are realized on the LSCs of the host content (the 
mode gives the iterate function, the strategy- adapter gives its strategy), and 
the last computed configuration is re-injected into the host content, in place of 
the former LSCs. 
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Notice that in order to preserve the unpredictable behavior of the system, 
the size of the digital medias is not fixed. This approach is thus self adapted to 
any media, and more particularly to any size of LSCs. However this flexibility 
enlarges the complexity of the presentation: we had to give Definitions [T] and [5] 
respectively of mode and strategy adapter. 




Figure 1: The dhCI dissimulation scheme 
Next section shows how to check whether a media contains a watermark. 

2.3 Decoding 

Let us firstly show how to formally check whether a given digital media z results 
from the dissimulation of y into the digital media x. 

Definition 10 (Watermarked content) Let deciu^m^M^ be a decomposi- 
tion function, / be a mode, 5 be a strategy adapter, g be a positive natural 
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number, y be a digital media, and {uM,UrmUp,4>M,4'm,'f>p) be the image by 
dec(u, m, M) of a digital media x. Then z is watermarked with y if the image 
by dec{u, m, M) of z is {um, Umi Up, 4>m, y, ipp): where y is the right member of 

i^yi 4'm)- 

Various decision strategics arc obviously possible to determine whether a 
given image z is watermarked or not, depending on the eventuality that the 
considered image may have been attacked. For example, a similarity percentage 
between x and z can be computed and compared to a given threshold. Other 
possibilities are the use of ROC curves or the definition of a null hypothesis 
problem. 

The next section recalls some security properties and shows how the dhCI 
dissimulation algorithm verifies them. 

3 Security analysis 

3.1 State-of-the-art in information hiding security 

As far as we know, Cachin |15j produces the first fundamental work in informa- 
tion hiding security: in the context of steganography, the attempt of an attacker 
to distinguish between an innocent image and a stego-content is viewed as an 
hypothesis testing problem. Mittelholzer [16] next proposed the first theoretical 
framework for analyzing the security of a watermarking scheme. Clarification 
between robustness and security and classifications of watermarking attacks 
have been firstly presented by Kalker [17j . This work has been deepened by 
Furon et al. [TH], who have translated Kerckhoffs' principle (Alice and Bob shall 
only rely on some previously shared secret for privacy), from cryptography to 
data hiding. 

More recently [50] classified the information hiding attacks into cate- 
gories, according to the type of information the attacker (Eve) has access to: 

• in Watermarked Only Attack (WOA) she only knows embedded contents 

• in Known Message Attack (KMA) she knows pairs {z, y) of embedded 
contents and corresponding messages; 

• in Known Original Attack (KOA) she knows several pairs (z, x) of embed- 
ded contents and their corresponding original versions; 

• in Constant-Message Attack (CMA) she observes several embedded con- 
tents z^,. . . ,z^ and only knows that the unknown hidden message y is the 
same in all contents. 

To the best of our knowledge, KMA, KOA, and CMA have not already been 
studied due to the lack of theoretical framework. In the opposite, security of 
data hiding against WOA can be evaluated, by using a probabilistic approach 
recalled below. 
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3.2 Stego-security 

In the Simmons' prisoner problem [5T], Alice and Bob are in jail and they want 
to, possibly, devise an escape plan by exchanging hidden messages in innocent- 
looking cover contents. These messages are to be conveyed to one another by 
a common warden named Eve, who eavesdrops all contents and can choose to 
interrupt the communication if they appear to be stego-contents. 

Stego-security, defined in this well-known context, is the highest security 
class in Watermark-Only Attack setup, which occurs when Eve has only access 
to several marked contents [8]. 

Let K be the set of embedding keys, p{X) the probabilistic model of iVo 
initial host contents, and p{Y\K) the probabilistic model of Nq marked contents 
s.t. each host content has been marked with the same key K and the same 
embedding function. 

Definition 11 (Stego-Security [8]) The embedding function is stego-secure 
if VA' e K,p{Y\K) = p{X) is established. 

Stego-security states that the knowledge of K does not help to make the dif- 
ference between p{X) and p{Y). This definition implies the following property: 

p{Y\K,) = ■■■= p{Y\KnJ = p{Y) = p{X) 

This property is equivalent to a zero KuUback-Lciblcr divergence, which is the 
accepted definition of the "perfect secrecy" in steganography [TS]. 

3.3 The negation mode is stego-secure 

To make this article self-contained, this section recalls theorems and proofs of 
stego-security for negation mode published in |10j . 

Proposition 1 dhCI dissimulation of Definition [P| with negation mode and 
CIIS strategy- adapter is stego-secure, whereas it is not the case when using CIDS 
strategy- adapter. 

Proof On the one hand, let us suppose that X ~ U (B") when using 
CIIS(if, _, _, Z). We prove by a mathematical induction that Mt G IN,X* ~ 
U(B"). 

The base case is immediate, as X° ^ X ^ U(B"). Let us now suppose 
that the statement X* ~ U (B") holds until for some t. Let e G B" and 
Bfe = (0, ■ • • , 0, 1, 0, • • • , 0) e B" (the digit 1 is in position k). 

So P = e) = P{X* = e® Bfc, 5'* = k) where © is again the bit- 

wise exclusive or. These two events arc independent when using CIIS strategy- 
adapter (contrary to CIDS, CIIS is not built by using X), thus: 

n 

P = e) = ^ P (X* = e ® Bfe) X P (5* fc) . 

k=l 
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According to the inductive hypothesis: P (X^^^ = e) = ^ Sfc=i P ('^* = 
The set of events {S* = k} for k G is a partition of the universe of pos- 

sible, so ELi -Pl-S** = k) = 1. Finally, P = e) = ^, which leads to 

- U (B"). This resuh is true for ah t G F and then for t = I. 

Since P{Y\K) is P{X^) that is proven to be equal to P{X), we thus have 
established that, 

yK e [0; 1],P{Y\K) = P(X') = 

So dhCI dissimulation with CIIS strategy-adaptor is stego-securc. 

On the other hand, due to the definition of CIDS, we have 
P{Y = (1, 1, • • ■ , 1)\K) = 0. So there is no uniform repartition for the stego- 
contents Y\K. 

To sum up, Alice and Bob can counteract Eve's attacks in WOA setup, when 
using dhCI dissimulation with CIIS strategy-adapter. To our best knowledge, 
this is the second time an information hiding scheme has been proven to be 
stego-secure: the former was the spread-spectrum technique in natural marking 
configuration with ry parameter equal to 1 [8]. 

3.4 A new class of e-stego-secure schemes 

Let us prove that. 

Theorem 1 Let e be positive, I be any size of LSCs, X ^ U(B') , /; be an 
image mode s.t. T{fi) is strongly connected and the Markov matrix associated 
to fi is doubly stochastic. In the instantiated dhCI dissimulation algorithm with 
any uniformly distributed (u.d.) strategy- adapter that is independent from X, 
there exists some positive natural number q s.t. \p{X'^) — p{X)\ < e. 

Proof Let deci be the bijection between B' and [0, 2' — 1] that associates 
the decimal value of any binary number in B'. The probability p{X^) = 
{p{X* = eo), . . . ,_p(X* = e2i_i)) for ej G B' is thus equal to {p[deci{X^) = 
0,...,p{deci{X*) = 2' - 1)) further denoted by tt*. Let i e |0, 2' - 1], the 
probability p{deci{X*^^) = i) is 

2'-l I 

J2 J2p{dect{X*) = J, S'^k,i J, fk{j) = ^k) 

j=0 k=l 

where i =fe j is true iff the binary representations of i and j may only differ 
for the fc-th element, and where ik abusively denotes, in this proof, the fc-th 
element of the binary representation of i. 

Next, due to the proposition's hypotheses on the strategy, p{deci{X*) = 
j,S* = k,i =k jJkU) = ik) is equal to j.p{deci{X*) = j,i =k jjkij) = h)- 
Finally, since i =k j and fk{.j) ~ ik are constant during the iterative process 
and thus does not depend on X*, we have 

2'-l I 
j=0 k=l 
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I 

Since j J2 P(* "fe J^fkU) ~ ik) is equal to Mji where M is the Markov 
fc=i 

matrix associated to // we thus have 

2'-l 

7r,*+i = ^ 7r*.Mji and thus 7r*+i = -k^M. 

3=0 

First of all, since the graph r(/) is strongly connected, then for all vertices 
i and j, a path can be found to reach j from i in at most 2' steps. There exists 
thus kij € |1,2'] s.t. Af*j'^ > 0. As all the multiples I x kij of hj are such 

Ixk 

that Ai;^:^'''^ > 0, we can conclude that, if k is the least common multiple of 
{k^j/i,j e [1,2']} thus Vi,j e |1,2'1,M^ > and thus Af is a regular stochastic 
matrix. 

Let us now recall the following stochastic matrix theorem: 

Theorem 2 (Stochastic Matrix) // AI is a regular stochastic matrix, then 
M has an unique stationary probability vector tt. Moreover, if tt^ is any initial 
probability vector and Tr*~^^ — tt* .M for t — 0,1, . . . then the Markov chain tt* 
converges to n as t tends to infinity. 

Thanks to this theorem, M has an unique stationary probability vector tt. By 
hypothesis, since M is doubly stochastic we have (^, . . . , ^) = (^, . . . , 
and thus tt = (^,...,^). Due to the matrix theorem, there exists some q s.t. 
Itt' — 7r| < e and the proof is established. Since p{Y\K) is p{X'') the method is 
then e-stego-secure provided the strategy-adapter is uniformly distributed. 

This section has focused on security with regards to probabilistic behaviors. 
Next section studies it in the perspective of topological ones. 

4 Chaos-security 

To check whether an existing data hiding scheme is chaotic or not, we propose 
firstly to write it as an iterate process = /(x"). It is possible to prove that 
this formulation can always be done, as follows. Let us consider a given data 
hiding algorithm. Because it must be computed one day, it is always possible 
to translate it as a Turing machine, and this last machine can be written as 
x"'~^^ = /(a;") in the following way. Let {w,i,q) be the current configuration of 
the Turing machine (Fig. [2]), where w = 'i~'^w{0) . . . w(fc)tt" is the paper tape, 
i is the position of the tape head, q is used for the state of the machine, and 
6 is its transition function (the notations used here are well-known and widely 
used). We define / by: 

• f{vu{0)...w{k),i,q) = {w{0) . . .w{i~l)aw{i+l)w{k),i+l,q'),iiS{q,w{i)) = 

• f{w{0) . . . w(k),i, q) = (u'(O) . . . w{i—V)aw{i^-V)w{k'), i— 1, q'), if (5(g, w(i)) = 
(q',a,^). 
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Thus the Turing machine can be written as an iterate function x'^'^^ = /(x") 
on a well-defined set X, with x° as the initial configuration of the machine. We 
denote by T{S) the iterative process of a data hiding scheme S. 

k 









w(i) 









q 



Figure 2: Turing Machine 

Let us now define the notion of chaos-security. Let r be a topology on X. 
So the behavior of this dynamical system can be studied to know whether or 
not the data hiding scheme is t— unpredictable. This leads to the following 
definition. 

Definition 12 An information hiding scheme S is said to be chaos-secure on 
{X, t) if its iterative process 7~(5') has a chaotic behavior, as defined by Dcvaney, 
on this topological space. 

Theoretically speaking, chaos-security can always be studied, as it only re- 
quires that the two following points are satisfied. 

• Firstly, the data hiding scheme must be written as an iterate function 
on a set X] As illustrated by the use of the Turing machine, it is always 
possible to satisfy this requirement; It is established here since we iterate 
G/ as defined in Sect. (|2.1|) : 

• Secondly, a metric or a topology must be defined on X; This is always 
possible, for example, by taking for instance the most relevant one, that 
is the order topology. 

Guyeux has recently shown in that chaotic iterations of Gj with the 
vectorial negation as iterate function have a chaotic behavior. As a corollary, 
we deduce that the dhCI dissimulation algorithm with negation mode and CIIS 
strategy-adapter is chaos-secure. 

However, all these results suffer from only relying on the vectorial negation 
function. This problem has been theoretically tackled in which provides the 
following theorem. 

Theorem 3 Functions f : B" — B" such that Gf is chaotic according to 
Devaney, are functions such that the graph T(f) is strongly connected. 

We deduce from this theorem that functions whose graph is strongly connected 
are sufficient to provide new instances of dhCI dissimulation that are chaos- 
secure. 

Computing a mode / such that the image of n {i.e., fn) is a function with 
a strongly connected graph of iterations r(/„) has been previously studied 
(see [22] for instance) . The next section presents a use of them in our steganog- 
raphy context. 
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5 Applications to frequential domains 



Wc arc then left to provide an u.d. strategy-adapter that is independent from 
the cover, an image mode /; whose iteration graph r(/;) is strongly connected 
and whose Markov matrix is doubly stochastic. 

First, the CIIS{K, y, a, I) strategy adapter (see Section [^?^ has the required 
properties: it does not depend on the cover and the proof that its outputs 
are u.d. on is left as an exercise for the reader. In all the experiments 

parameters K and a are randomly chosen in ]]0,1| and ]]0,0.5| respectively. 
The number of iteration is set to 4 * Im, where Im is the number of LSCs that 
depends on the domain. 

Next, |22| has presented an iterative approach to generate image modes /; 
such that r(/;) is strongly connected. Among these maps, it is obvious to check 
which verifies or not the doubly stochastic constrain. For instance, in what 
follows we consider the mode // : B' — > B' s.t. its ith component is defined by 



Thanks to [22] Theorem 2] we deduce that its iteration graph T{fi) is strongly 
connected. Next, the Markov chain is stochastic by construction. 

Let us prove that its Markov chain is doubly stochastic by induction on the 
length For I = 1 and / ~ 2 the proof is obvious. Let us consider that the 
result is established until / = 2k for some fc S N. 

Let us then firstly prove the doubly stochasticity for I = 2k + 1. Fol- 
lowing notations introduced in [22], let r(/2fe+i)" and r(/2fc+i)^ denote the 
subgraphs of r(/2fc+i) induced by the subset B^*^ x {0} and B^*^ x {1} of 
]32fe+i respectively. r(/2A:+i)° and r(/2fe+i)^ are isomorphic to r(/2fc)- Fur- 
thermore, these two graphs are linked together only with arcs of the form 
{xi,...,X2k,0) -> (xi, . . . ,X2fc, 1) and (ii, . . . , X2fc, 1) (xi, . . . , X2fc, 0). In 
r(/2fc+i) the number of arcs whose extremity is . . . , X2fc, 0) is the same 
than the number of arcs whose extremity is (xi, . . . ,X2k) augmented with 1, 
and similarly for (xi, . . . ,X2k, !)■ By induction hypothesis, the Markov chain 
associated to T{f2k) is doubly stochastic. Ah the vertices {xi, . . . ,X2k) have 
thus the same number of ingoing arcs and the proof is established for I is 2fc-|- 1. 

Let us then prove the doubly stochasticity for I = 2k + 2. The map /; 
is defined by fi{x) = {xT,X2 © xi, . . . ,X2k+i,X2k+2 © X2k+i)- With previously 
defined notations, let us focus on r(/2fc+2)'' and T{f2k+2)^ which are isomorphic 
to r(/2fc+i). Among configurations of B^'^'"'"^, only four suffixes of length 2 can 
be obviously observed, namely, 00, 10, 11 and 01. Since /2fc+2(- ■ • 7 0, 0)2fe+2 = 0, 

/2fc+2(- • • , l,0)2fe+2 = 1, /2fe+2(- ■ • , 1, l)2fc+2 0, and /2fc+2(- ■ • , 0, l)2fe+2 = 1, 

the number of arcs whose extremity is 

• (xi, . . . , X2fc, 0, 0) is the same than the one whose extremity is (xi, . . . , X2fc, 0) 
in r(/2fc+i) augmented with 1 (loop over configurations (xi, . . . , X2fc, 0, 0)); 

• (xi, . . . , X2fc, 1,0) is the same than the one whose extremity is (xi, . . . , X2fc, 0) 




Xi © Xi_i if i is even 



(1) 
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in r(/2fe+i) augmented with 1 (arc from configurations {xi, . . . ,X2k, 1, 1) 
to configurations (xi, . . . ,X2k, I7O)); 

• (xi, . . . , X2k, 0, 1) is the same than the one whose extremity is {xi, . . . , X2k, 0) 
in r(/2fe+i) augmented with 1 (loop over configurations (xi, . . . , X2k, 0, 1)); 

• (xi , . . . , X2k , 1 , 1) is the same than the one whose extremity is {xi , . . . , X2k , 1) 
in r(/2/c+i) augmented with 1 (arc from configurations {xi, . . . , X2k, 1, 0) 
to configurations {xi, . . . ,X2k, 1, !))• 

Thus all the vertices (xi, . . . ,X2k) have the same number of ingoing arcs and 
the proof is established for I = 2k + 2. 

5.1 DWT embedding 

Let us now explain how the dhCI dissimulation can be applied in the discrete 
wavelets domain (DWT). In this paper, the Daubechies family of wavelets is 
chosen: each DWT decomposition depends on a decomposition level and a coef- 
ficient matrix (Figure[3|: LL means approximation coefficient, when HH, LH, HL 
denote respectively diagonal, vertical, and horizontal detail coefficients. For ex- 
ample, the DWT coefficient HH2 is the matrix equal to the diagonal detail 
coefficient of the second level of decomposition of the image. 



LL2 



HL2 



LH2 



HH2 



LHl 



HLl 



HHl 



Figure 3: Wavelets coefficients. 

The choice of the detail level is motivated by finding a good compromise 
between robustness and invisibility. Choosing low or high frequencies in DWT 
domain leads either to a very fragile watermarking without robustness (espe- 
cially when facing a JPEG2000 compression attack) or to a large degradation 
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of the host content. In order to have a robust but discrete DWT embedding, 
the second detail level (i.e., LH2, HL2, HH2) that corresponds to the middle 
frequencies, has been retained. 

Let us consider the Daubcchies wavelet coefficients of a third level decompo- 
sition as represented in Figure |31 We then translate these float coefficients into 
their 32-bits values. Let us define the significance function u that associates to 
any index k in this sequence of bits the following numbers: 

• u'^ = — 1 if fc is one of the three last bits of any index of coefficients in 
LH2, HL2, or in HH2; 

• = if fc is an index of a coefficient in LHl, HLl, or in HHl; 

• u'' — 1 otherwise. 

According to the definition of significance of coefficients (Dcf. [5]), if {m,M) 
is (—0.5, 0.5), LSCs are the last three bits of coefficients in HL2,HH2, and LH2. 
Thus, decomposition and recomposition functions are fully defined and dhCI 
dissimulation scheme can now be applied. 

Figure 2] shows the result of a dhCI dissimulation embedding into DWT 
domain. The original is the image 5007 of the BOSS contest [23]. Watermark 
y is given in Fig. |4(b)[ 

From a random selection of 50 images into the database from the BOSS 
contest [23j . we have applied the previous algorithm with mode fi defined in 
Equation ([T]) and with the negation mode. 

5.2 DCT embedding 

Let us denote by x the original image of size H x and by y the hidden message, 
supposed here to be a binary image of size H' x L' . The image x is transformed 
from the spatial domain to DCT domain frequency bands, in order to embed y 
inside it. To do so, the host image is firstly divided into 8x8 image blocks as 
given below: 

H/8 L/8 
X=[j [j x{k,k'). 
k=l k' = l 

Thus, for each image block, a DCT is performed and the coefficients in the 
frequency bands are obtained as follows: xocTim-jn) = DCT{x{m;n)). 

To define a discrete but robust scheme, only the four following coefficients of 
each 8x8 block in position {m,n) will be possibly modified: a;£icT("^; '^)(3,i), 
XDCxijn', '^)(2,2)j or XDCxi'Ti', '^)(i,3)- This choice can be reformulated as follows. 
Coefficients of each DCT matrix are re- indexed by using a southwest/northeast 
diagonal, such that i_DCT(™7 't-)! = a;£)CT(™; ")(i,i), 

incTim, n)2 = xocTim; n)(2,i), iocTim, 12)3 = XDCT{m; ?^)(i,2), iDcrim, n)^ = 
xdct (to;"-) (3,1)' 'iDCT{rn,n)e4: = XDCTim;n)(^g„8)- So the signification 

function can be defined in this context by: 

• if A: mod 64 G {1, 2, 3} and k ^ H x L, then u'' = 1; 
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(a) Original Imago. 



(b) 

Water- 
mark 

y- 




(c) Watermarked Im- 
age. 

Figure 4: Data hiding in DWT domain 



• else if k mod 64 G {4, 5, 6} and k ^ H x L, then u'^ = — 1; 

• else u'' = 0. 

The significance of coefficients are obtained for instance with (m, M) = (—0.5, 0.5) 
leading to the definitions of MSCs, LSCs, and passive coefficients. Thus, decom- 
position and recomposition functions are fully defined and dhCI dissimulation 
scheme can now be applied. 

5.3 Image quality 

This section focuses on measuring visual quality of our steganographic method. 
Traditionally, this is achieved by quantifying the similarity between the modified 
image and its reference image. The Mean Squared Error (MSE) and the Peak 
Signal to Noise Ratio (PSNR) are the most widely known tools that provide such 
a metric. However, both of them do not take into account Human Visual System 
(HVS) properties. Recent works [24l [25l [26l [27] have tackled this problem 
by creating new metrics. Among them, what follows focuses on PSNR-HVS- 
M [26] and BIQI [27], considered as advanced visual quality metrics. The former 
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Embedding 


DWT 


DCT 


Mode 


/; 


neg. 


fl 


neg. 


PSNR 


42.74 


42.76 


52.68 


52.41 


PSNR-HVS-M 


44.28 


43.97 


45.30 


44.93 


BIQI 


35.35 


32.78 


41.59 


47.47 



Table 1: Quality measeures of our steganography approach 

efficiently combines PSNR and visual between-coefficient contrast masking of 
DCT basis functions based on HVS. This metric has been computed here by 
using the implementation given at |28| . The latter allows to get a blind image 
quality assessment measure, i.e., without any knowledge of the source distortion. 
Its implementation is available at [29] . 

Results of the image quality metrics are summarized into the Table [T] In 
wavelet domain, the PSNR values obtained here are comparable to other ap- 
proaches (for instance, PSNR are 44.2 in [30] and 46.5 in [31]), but a real 
improvement for the discrete cosine embeddings is obtained (PSNR is 45.17 
for [22], it is always lower than 48 for [35], and always lower than 39 for [31]). 
Among steganography approaches that evaluate PSNR-HVS-M, results of our 
approach are convincing. Firstly, optimized method developed along [35| has a 
PSNR-HVS-M equal to 44.5 whereas our approach, with a similar PSNR-HVS- 
M, should be easily improved by considering optimized mode. Next, another 
approach [36] have higher PSNR-HVS-M, certainly, but this work does not ad- 
dress robustness evaluation whereas our approach is complete. Finally, as far 
as we know, this work is the first one that evaluates the BIQI metric in the 
steganography context. 

With all this material, we are then left to evaluate the robustness of this 
approach. 

5.4 Robustness 

Previous sections have formalized frequential domains embeddings and has fo- 
cused on the negation mode and fi defined in Equ. ([IJ. In the robustness given 
in this continuation, dwt(neg), dwt(fl), dct(neg), dct(fl) respectively stand for 
the DWT and DCT embedding with the negation mode and with this instanti- 
ated mode. 

For each experiment, a set of 50 images is randomly extracted from the 
database taken from the BOSS contest [23]. Each cover is a 512 x 512 grayscale 
digital image and the watermark y is given in Fig |4(b)[ Testing the robustness 
of the approach is achieved by successively applying on watermarked images 
attacks like cropping, compression, and geometric transformations. Differences 
between y and (pmiz) are computed. Behind a given threshold rate, the image 
is said to be watermarked. Finally, discussion on metric quality of the approach 
is given in Sect. 15.51 
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Robustness of the approach is evaluated by applying different percentage of 
cropping: from 1% to 81%. Results are presented in Fig. [5] Fig. |5(a) gives the 
cropped image where 36% of the image is removed. Fig. |5(b)| presents effects 
of such an attack. From this experiment, one can conclude that all embeddings 
have similar behaviors. All the percentage differences are so far less than 50% 
(which is the mean random error) and thus robustness is established. 




(a) Cropped Image. 




Percentage of Cropping 



(b) Cropping Effect 



Figure 5: Cropping Results 



5.4.1 Robustness against compression 

Robustness against compression is addressed by studying both JPEG and JPEG 



2000 image compressions. Results are respectively presented in Fig. 6(a) and 
Fig. |6(b)[ Without surprise, DCT embedding which is based on DCT (as JPEG 
compression algorithm is) is more adapted to JPEG compression than DWT em- 
bedding. Furthermore, we have a similar behavior for the JPEG 2000 compres- 
sion algorithm, which is based on wavelet encoding: DWT embedding naturally 
outperforms DCT one in that case. 











- - dwt(neg) 

- dwt(fl} 

- - dct(neg) 

dct(fl) 









JPEG Compression Ratio 



- - dwt(neg) 

- dwt(fl) 

- - dct(neg) 

dct(fl) 



JPEG 2Q0O Compression Ratio 



(a) JPEG Effect (b) JPEG 2000 Effect 

Figure 6: Compression Results 
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5.4.2 Robustness against Contrast and Sharpness Attack 

Contrast and Sharpness adjustment belong to the the classical set of filtering 



image attacks. Results of such attacks are presented in Fig.[7]where Fig. 7(a) and 
Fig. |7(b)| summarize effects of contrast and sharpness adjustment respectively. 





1.2 1.3 



(a) Contrast Effect (b) Sharpness Effect 

Figure 7: Filtering Results 



5.4.3 Robustness against Geometric Transformation 

Among geometric transformations, wc focus on rotations, i.e., when two oppo- 
site rotations of angle 6 arc successively applied around the center of the image. 
In these geometric transformations, angles range from 2 to 20 degrees. Results 



are presented in Fig. [H Fig. 8(a) gives the image of a rotation of 20 degrees 
whereas Fig. |8(b)| presents effects of such an attack. It is not a surprise that 
results are better for DCT embeddings: this approach is based on cosine as 
rotation is. 



5.5 Evaluation of the Embeddings 

Wc are then left to set a convenient threshold that is accurate to determine 
whether an image is watermarked or not. Starting from a set of 100 images 
selected among the Boss image Panel, we compute the following three sets: the 
one with all the watermarked images W, the one with all successively water- 
marked and attacked images WA, and the one with only the attacked images A. 
Notice that the 100 attacks for each images are selected among these detailed 
previously. 

For each threshold t S |0, 55| and a given image x € WA U A, differences on 
DCT are computed. The image is said to be watermarked if these differences 
are less than the threshold. In the positive case and if x really belongs to WA 
it is a True Positive (TP) case. In the negative case but if x belongs to WA it 
is a False Negative (FN) case. In the positive case but if x belongs to A, it is 
a False Positive (FP) case. Finally, in the negative case and if x belongs to A, 
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(a) 20 degrees Rotation 
Image 




5 - - dct(neg) 

" dct(fl) 

°2 4 6 B 10 12 14 16 18 20 

RoCation Ang\e {degree) 

(b) Rotation Effect 

Figure 8: Rotation Attack Results 

it is a True Negative (TN). The True (rcsp. False) Positive Rate (TPR) (resp. 
FPR) is thus computed by dividing the number of TP (resp. FP) by 100. 

The Figure |9] is the Receiver Operating Characteristic (ROC) curve. For 
the DWT, it shows that best results are obtained when the threshold is 45% 
for the dedicated function (corresponding to the point (0.01, 0.88)) and 46% 
for the negation function (corresponding to the point (0.04, 0.85)). It allows 
to conclude that each time LSCs differences between a watermarked image and 
another given image i' are less than 45%, we can claim that i' is an attacked 
version of the original watermarked content. For the two DCT embeddings, best 
results are obtained when the threshold is 44% (corresponding to the points 
(0.05, 0.18) and (0.05, 0.28)). 

Let us then give some confidence intervals for all the evaluated attacks. The 
approach is resistant to: 

• all the croppings where percentage is less than 85; 

• compressions where quality ratio is greater than 82 with DWT embedding 
and where quality ratio is greater than 67 with DCT one; 

• contrast when strengthening belongs to [0.76,1.2] (resp. [0.96,1.05]) in 
DWT (resp. in DCT) embedding; 
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Figure 9: ROC Curves for DWT or DCT Embeddings 

• all the rotation attacks with DCT embedding and a rotation where angle 
is less than 13 degrees with DWT one. 

6 Conclusion 

This paper has proposed a new class of secure and robust information hiding 
algorithms. It has been entirely formalized, thus allowing both its theoretical se- 
curity analysis, and the computation of numerous variants encompassing spatial 
and frequency domain embedding. After having presented the general algorithm 
with detail, we have given conditions for choosing mode and strategy-adapter 
making the whole class stego-secure or e-stego-secure. To our knowledge, this 
is the first time such a result has been established. 

Applications in frequency domains (namely DWT and DCT domains) have 
finally be formalized. Complete experiments have allowed us first to evaluate 
how invisible is the stcganographic method (thanks to the PSNR computation) 
and next to verify the robustness property against attacks. Furthermore, the 
use of ROC curves for DWT embedding have revealed very high rates between 
True positive and False positive results. 

In future work, our intention is to find the best image mode with respect to 
the combination between DCT and DWT based steganography algorithm. Such 
a combination topic has already been addressed {e.g., in |37|). but never with 
objectives we have set. 

Additionally, we will try to discover new topological properties for the dhCI 
dissimulation schemes. Consequences of these chaos properties will be drawn 
in the context of information hiding security. We will especially focus on the 
links between topological properties and classes of attacks, such as KOA, KMA, 
EOA, or CMA. 

Moreover, these algorithms will be compared to other existing ones, among 
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other things by testing whether these algorithms are chaotic or not. Finally 
we plan to verify the robustness of our approach against statistical steganalysis 
methods [3i [Ml SOI EI] ■ 
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